@openclaw/codex 2026.9.2 → 2026.9.3

package/dist/{config-CyapYSji.js → config-options-jnIFvwxD.js}

@@ -1,62 +1,14 @@
-import { a as normalizeHeaders, c as readExecAsk, d as readNumberEnv, f as readRecord, g as CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN, i as normalizeCodexServiceTier, l as readExecSecurity, o as normalizePositiveNumber, p as resolveArgs, r as normalizeCodexAppServerSecretInput, s as readBooleanEnv, t as hashSecretForKey, u as readNonEmptyString } from "./config-utils-C57JiJrU.js";
-import { m as readCodexAppServerConfigOptions, p as normalizeCodexAppServerArgs } from "./managed-binary-DcpnJF9x.js";
-import { asNullableRecord, isRecord, normalizeOptionalString, normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { a as normalizeHeaders, d as readNumberEnv, f as readRecord, i as normalizeCodexServiceTier, o as normalizePositiveNumber, p as resolveArgs, r as normalizeCodexAppServerSecretInput, s as readBooleanEnv, t as hashSecretForKey, u as readNonEmptyString } from "./config-utils-C57JiJrU.js";
+import { _ as assertCodexAppServerCommandHasNoInlineArgs, d as DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX, f as DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS, g as DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS, h as DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, l as resolveCodexAppServerUserHomeDir, o as isJsonObject, p as DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS, s as resolveCodexAppServerHomeDir, x as readCodexPluginConfig } from "./protocol-CAAcVIKF.js";
+import { r as readCodexAppServerConfigOptions } from "./launch-args-RXQwn8zV.js";
+import { normalizeTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createHash } from "node:crypto";
-import { resolveAgentConfig } from "openclaw/plugin-sdk/agent-scope-runtime";
-import { z } from "zod";
-import { buildSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
-import path from "node:path";
-import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-runtime";
-import { readFileSync } from "node:fs";
-import { homedir, hostname } from "node:os";
-import { resolveProviderIdForAuth } from "openclaw/plugin-sdk/agent-runtime";
-import { resolveExecApprovalsFromFile } from "openclaw/plugin-sdk/exec-approvals-runtime";
-import { detectWindowsSpawnCommandInlineArgs } from "openclaw/plugin-sdk/windows-spawn";
+import { AgentHarnessPreflightError } from "openclaw/plugin-sdk/agent-harness-registration";
 import { parse } from "smol-toml";
-import { isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
-//#region extensions/codex/src/app-server/protocol.ts
-/** Namespace Codex keeps directly model-visible without exposing it to Code Mode guests. */
-const CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE = "openclaw_direct";
-function flattenCodexDynamicToolFunctions(tools) {
-	return (tools ?? []).flatMap((tool) => tool.type === "namespace" ? tool.tools : [tool]);
-}
-const CODEX_INTERACTIVE_THREAD_SOURCE_KINDS = ["cli", "vscode"];
-const CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES = ["atlas", "chatgpt"];
-function isJsonObject(value) {
-	return isRecord(value);
-}
-function isRpcResponse(message) {
-	return "id" in message && !("method" in message);
-}
-//#endregion
-//#region extensions/codex/src/app-server/auth-start-options.ts
-const CODEX_APP_SERVER_HOME_DIRNAME = "codex-home";
-const CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE = "cli_auth_credentials_store=\"ephemeral\"";
-function resolveCodexAppServerHomeDir(agentDir) {
-	return path.join(path.resolve(agentDir), CODEX_APP_SERVER_HOME_DIRNAME);
-}
-/** Resolves the native user Codex home used by Desktop and the CLI. */
-function resolveCodexAppServerUserHomeDir(env = process.env, homedir$1 = homedir) {
-	const configured = normalizeOptionalString(env.CODEX_HOME);
-	return path.resolve(configured ?? path.join(homedir$1(), ".codex"));
-}
-/** Resolves the local CODEX_HOME used when starting one app-server connection. */
-function resolveCodexAppServerLocalHomeDir(startOptions, agentDir, env = process.env) {
-	const configured = startOptions.env?.CODEX_HOME;
-	if (configured?.trim()) return configured;
-	return startOptions.homeScope === "user" ? resolveCodexAppServerUserHomeDir(env) : resolveCodexAppServerHomeDir(agentDir);
-}
-/** Forces OpenClaw-owned Codex auth to remain process-local. */
-function withEphemeralCodexAuthStore(params) {
-	const { startOptions } = params;
-	if (!params.preparedAuth && params.authProfileId === null) return startOptions;
-	const args = normalizeCodexAppServerArgs(startOptions.args, CODEX_EPHEMERAL_AUTH_STORE_OVERRIDE);
-	return args === startOptions.args ? startOptions : {
-		...startOptions,
-		args
-	};
-}
-//#endregion
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { hostname } from "node:os";
+import { isLoopbackHost } from "openclaw/plugin-sdk/request-url";
 //#region extensions/codex/src/app-server/config-exec-policy.ts
 function selectForcedPromptingSandbox(params) {
 	if (params.configuredSandbox === "read-only" || params.defaultSandbox === "read-only") return "read-only";
@@ -87,27 +39,6 @@ function resolveSandbox(value) {
 function resolveApprovalsReviewer(value) {
 	return value === "auto_review" || value === "guardian_subagent" || value === "user" ? value : void 0;
 }
-function resolveOpenClawExecPolicyFromConfig(params) {
-	const globalExec = readRecord(params.config?.tools?.exec);
-	const globalPolicy = applyOpenClawExecPolicyLayer(createDefaultOpenClawExecPolicy(), globalExec);
-	const agentId = params.agentId?.trim();
-	return applyOpenClawExecPolicyLayer(globalPolicy, agentId ? readRecord(resolveAgentConfig(params.config ?? {}, agentId)?.tools?.exec) : void 0);
-}
-function resolveOpenClawExecPolicyForCodexAppServer(params) {
-	if (params.permissionMode === "full") return {
-		...resolveOpenClawExecPolicyForMode("full"),
-		touched: true
-	};
-	const overridePolicy = applyOpenClawExecPolicyLayer(resolveOpenClawExecPolicyFromConfig({
-		config: params.config,
-		agentId: params.agentId
-	}), params.execOverrides);
-	return applyOpenClawExecApprovalFloors(overridePolicy, resolveOpenClawExecApprovalFloorsForCodexAppServer({
-		approvals: params.approvals,
-		agentId: params.agentId,
-		policy: overridePolicy
-	}));
-}
 function resolveEffectiveOpenClawExecModeForCodexAppServer(params) {
 	if (params.execPolicy?.touched === true) return params.execPolicy.mode;
 	return params.execMode;
@@ -119,351 +50,6 @@ function resolveCodexPolicyModeForOpenClawExecMode(mode) {
 function assertCodexAppServerAllowedForOpenClawExecMode(mode) {
 	if (mode === "deny" || mode === "allowlist") throw new AgentHarnessPreflightError(`Codex app-server local execution is unavailable because effective tools.exec.mode=${mode}. Execution-host approvals are authoritative. For gateway turns, inspect them with \`openclaw approvals get --gateway\` and update that same target with \`openclaw approvals set --gateway --stdin\`; for local \`agent exec\`, omit \`--gateway\`. Intentionally align that host policy before retrying.`, { scope: "harness" });
 }
-function createDefaultOpenClawExecPolicy() {
-	return {
-		...resolveOpenClawExecPolicyForMode("full"),
-		touched: false
-	};
-}
-function applyOpenClawExecPolicyLayer(base, exec) {
-	if (!exec) return base;
-	const mode = readExecMode(exec.mode);
-	if (mode !== void 0) return {
-		...resolveOpenClawExecPolicyForMode(mode),
-		touched: true
-	};
-	const security = readExecSecurity(exec.security);
-	const ask = readExecAsk(exec.ask);
-	if (security === void 0 && ask === void 0) return base;
-	const nextSecurity = security ?? base.security;
-	const nextAsk = ask ?? base.ask;
-	return {
-		mode: resolveOpenClawExecModeFromPolicy({
-			security: nextSecurity,
-			ask: nextAsk
-		}),
-		security: nextSecurity,
-		ask: nextAsk,
-		touched: true
-	};
-}
-function resolveOpenClawExecApprovalFloorsForCodexAppServer(params) {
-	if (!params.approvals) return;
-	return resolveExecApprovalsFromFile({
-		file: params.approvals,
-		agentId: params.agentId,
-		overrides: {
-			security: params.policy.security,
-			ask: params.policy.ask
-		}
-	}).agent;
-}
-function applyOpenClawExecApprovalFloors(base, approvalFloors) {
-	if (!approvalFloors) return base;
-	const nextSecurity = approvalFloors.security ? minOpenClawExecSecurity(base.security, approvalFloors.security) : base.security;
-	const nextAsk = approvalFloors.ask ? maxOpenClawExecAsk(base.ask, approvalFloors.ask) : base.ask;
-	if (nextSecurity === base.security && nextAsk === base.ask) return base;
-	return {
-		mode: resolveOpenClawExecModeFromPolicy({
-			security: nextSecurity,
-			ask: nextAsk
-		}),
-		security: nextSecurity,
-		ask: nextAsk,
-		touched: true
-	};
-}
-function resolveOpenClawExecPolicyForMode(mode) {
-	switch (mode) {
-		case "deny": return {
-			mode,
-			security: "deny",
-			ask: "off"
-		};
-		case "allowlist": return {
-			mode,
-			security: "allowlist",
-			ask: "off"
-		};
-		case "ask":
-		case "auto": return {
-			mode,
-			security: "allowlist",
-			ask: "on-miss"
-		};
-		case "full": return {
-			mode,
-			security: "full",
-			ask: "off"
-		};
-	}
-	return mode;
-}
-function resolveOpenClawExecModeFromPolicy(params) {
-	if (params.security === "deny") return "deny";
-	if (params.security === "allowlist" && params.ask === "off") return "allowlist";
-	if (params.security === "full" && params.ask !== "always") return "full";
-	return "ask";
-}
-function minOpenClawExecSecurity(left, right) {
-	const order = {
-		deny: 0,
-		allowlist: 1,
-		full: 2
-	};
-	return order[left] <= order[right] ? left : right;
-}
-function maxOpenClawExecAsk(left, right) {
-	const order = {
-		off: 0,
-		"on-miss": 1,
-		always: 2
-	};
-	return order[left] >= order[right] ? left : right;
-}
-function readExecMode(value) {
-	return value === "deny" || value === "allowlist" || value === "ask" || value === "auto" || value === "full" ? value : void 0;
-}
-//#endregion
-//#region extensions/codex/src/app-server/session-discovery-config.ts
-const codexSessionCatalogHomeSchema = z.union([z.string().trim().min(1), z.object({
-	path: z.string().trim().min(1),
-	label: z.string().trim().min(1).optional()
-}).strict()]);
-const codexSessionCatalogConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	homes: z.array(codexSessionCatalogHomeSchema).optional()
-}).strict();
-const codexDiscoveryConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	timeoutMs: z.number().positive().optional()
-}).strict();
-//#endregion
-//#region extensions/codex/src/app-server/config-parsing.ts
-const DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME = "computer-use";
-const DEFAULT_CODEX_COMPUTER_USE_MARKETPLACE_DISCOVERY_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_LIVE_TEST_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_COMPUTER_USE_TOOL_CALL_TIMEOUT_MS = 6e4;
-const DEFAULT_CODEX_APP_SERVER_NETWORK_PROXY_PROFILE_PREFIX = "openclaw-network";
-const codexAppServerTransportSchema = z.enum([
-	"stdio",
-	"websocket",
-	"unix"
-]);
-const codexAppServerHomeScopeSchema = z.enum(["agent", "user"]);
-const SecretInputSchema = buildSecretInputSchema();
-const codexAppServerPolicyModeSchema = z.enum(["yolo", "guardian"]);
-const codexAppServerApprovalPolicySchema = z.preprocess((value) => value === "on-failure" ? "on-request" : value, z.enum(["never", "on-request"]));
-const codexAppServerSandboxSchema = z.enum([
-	"read-only",
-	"workspace-write",
-	"danger-full-access"
-]);
-const codexAppServerApprovalsReviewerSchema = z.enum([
-	"user",
-	"auto_review",
-	"guardian_subagent"
-]);
-const codexDynamicToolsLoadingSchema = z.enum(["searchable", "direct"]);
-const codexComputerUseHealthIntervalSchema = z.union([
-	z.literal(30),
-	z.literal(60),
-	z.literal(120),
-	z.literal(240)
-]);
-const codexComputerUsePluginCacheModeSchema = z.enum(["shared", "independent"]);
-const codexPluginDestructivePolicySchema = z.union([
-	z.boolean(),
-	z.literal("auto"),
-	z.literal("ask")
-]);
-const codexAppServerServiceTierSchema = z.preprocess((value) => value === null ? null : normalizeCodexServiceTier(value), z.string().trim().min(1).nullable().optional()).optional();
-const codexAppServerExperimentalSchema = z.object({ sandboxExecServer: z.boolean().optional() }).strict();
-const codexAppServerRemoteWorkspaceRootSchema = z.string().trim().min(1);
-const codexAppServerNetworkProxyDomainPermissionSchema = z.enum(["allow", "deny"]);
-const codexAppServerNetworkProxyUnixSocketPermissionSchema = z.enum(["allow", "none"]);
-const codexAppServerNetworkProxySchema = z.object({
-	enabled: z.boolean().optional(),
-	profileName: z.string().trim().min(1).optional(),
-	baseProfile: z.enum(["read-only", "workspace"]).optional(),
-	mode: z.enum(["limited", "full"]).optional(),
-	domains: z.record(z.string(), codexAppServerNetworkProxyDomainPermissionSchema).optional(),
-	unixSockets: z.record(z.string(), codexAppServerNetworkProxyUnixSocketPermissionSchema).optional(),
-	proxyUrl: z.string().trim().min(1).optional(),
-	socksUrl: z.string().trim().min(1).optional(),
-	enableSocks5: z.boolean().optional(),
-	enableSocks5Udp: z.boolean().optional(),
-	allowUpstreamProxy: z.boolean().optional(),
-	allowLocalBinding: z.boolean().optional(),
-	dangerouslyAllowNonLoopbackProxy: z.boolean().optional(),
-	dangerouslyAllowAllUnixSockets: z.boolean().optional()
-}).strict();
-const codexPluginEntryConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	marketplaceName: z.string().regex(CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN).optional(),
-	pluginName: z.string().trim().min(1).optional(),
-	allow_destructive_actions: codexPluginDestructivePolicySchema.optional()
-}).strict();
-const codexPluginsConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	allow_all_plugins: z.boolean().optional(),
-	allow_destructive_actions: codexPluginDestructivePolicySchema.optional(),
-	plugins: z.record(z.string(), codexPluginEntryConfigSchema).optional()
-}).strict();
-const codexSupervisionEndpointSchema = z.union([z.object({
-	id: z.string().optional(),
-	label: z.string().optional(),
-	transport: z.literal("stdio-proxy").optional(),
-	command: z.string().optional(),
-	args: z.array(z.string()).optional(),
-	cwd: z.string().optional()
-}).strict(), z.object({
-	id: z.string().optional(),
-	label: z.string().optional(),
-	transport: z.literal("websocket"),
-	url: z.string(),
-	authTokenEnv: z.string().optional()
-}).strict()]);
-const codexSupervisionConfigSchema = z.object({
-	enabled: z.boolean().optional(),
-	endpoints: z.array(codexSupervisionEndpointSchema).optional(),
-	allowRawTranscripts: z.boolean().optional(),
-	allowWriteControls: z.boolean().optional()
-}).strict();
-const codexPluginConfigSchema = z.object({
-	codexDynamicToolsLoading: codexDynamicToolsLoadingSchema.optional(),
-	codexDynamicToolsExclude: z.array(z.string()).optional(),
-	sessionCatalog: codexSessionCatalogConfigSchema.optional(),
-	discovery: codexDiscoveryConfigSchema.optional(),
-	computerUse: z.object({
-		enabled: z.boolean().optional(),
-		autoInstall: z.boolean().optional(),
-		marketplaceDiscoveryTimeoutMs: z.number().positive().optional(),
-		liveTestTimeoutMs: z.number().positive().optional(),
-		toolCallTimeoutMs: z.number().positive().optional(),
-		healthCheckEnabled: z.boolean().optional(),
-		healthCheckIntervalMinutes: codexComputerUseHealthIntervalSchema.optional(),
-		pluginCacheMode: codexComputerUsePluginCacheModeSchema.optional(),
-		strictReadiness: z.boolean().optional(),
-		autoRepair: z.boolean().optional(),
-		marketplaceSource: z.string().optional(),
-		marketplacePath: z.string().optional(),
-		marketplaceName: z.string().optional(),
-		pluginName: z.string().optional(),
-		mcpServerName: z.string().optional()
-	}).strict().optional(),
-	codexPlugins: z.unknown().optional(),
-	supervision: codexSupervisionConfigSchema.optional(),
-	appServer: z.object({
-		mode: codexAppServerPolicyModeSchema.optional(),
-		transport: codexAppServerTransportSchema.optional(),
-		homeScope: codexAppServerHomeScopeSchema.optional(),
-		command: z.string().optional(),
-		args: z.union([z.array(z.string()), z.string()]).optional(),
-		url: z.string().optional(),
-		authToken: SecretInputSchema.optional(),
-		headers: z.record(z.string(), SecretInputSchema).optional(),
-		clearEnv: z.array(z.string()).optional(),
-		remoteWorkspaceRoot: codexAppServerRemoteWorkspaceRootSchema.optional(),
-		codeModeOnly: z.boolean().optional(),
-		loopDetectionPreToolUseRelay: z.boolean().optional(),
-		requestTimeoutMs: z.number().positive().optional(),
-		approvalPolicy: codexAppServerApprovalPolicySchema.optional(),
-		sandbox: codexAppServerSandboxSchema.optional(),
-		approvalsReviewer: codexAppServerApprovalsReviewerSchema.optional(),
-		serviceTier: codexAppServerServiceTierSchema,
-		networkProxy: codexAppServerNetworkProxySchema.optional(),
-		defaultWorkspaceDir: z.string().optional(),
-		experimental: codexAppServerExperimentalSchema.optional()
-	}).strict().optional()
-}).strict();
-function readCodexPluginConfig(value) {
-	if (asNullableRecord(asNullableRecord(value)?.appServer)?.approvalPolicy === "untrusted") throw new Error("plugins.entries.codex.config.appServer.approvalPolicy=\"untrusted\" is retired; run \"openclaw doctor --fix\" to migrate it to \"on-request\".");
-	const parsed = codexPluginConfigSchema.safeParse(value);
-	if (!parsed.success) return {};
-	const { codexPlugins: rawCodexPlugins, ...config } = parsed.data;
-	const plugins = codexPluginsConfigSchema.safeParse(rawCodexPlugins);
-	if (!plugins.success) return config;
-	return {
-		...config,
-		...plugins.data ? { codexPlugins: plugins.data } : {}
-	};
-}
-function isCodexSandboxExecServerEnabled(pluginConfig, sandbox) {
-	return isCodexRemoteExecPlacementSandbox(sandbox) || readCodexPluginConfig(pluginConfig).appServer?.experimental?.sandboxExecServer === true;
-}
-function isCodexRemoteExecPlacementSandbox(sandbox) {
-	return typeof sandbox === "object" && sandbox !== null && "placementExecutionMode" in sandbox && sandbox.placementExecutionMode === "remote-exec";
-}
-function isCodexPairedNodeRemoteExecPlacementSandbox(sandbox) {
-	return isCodexRemoteExecPlacementSandbox(sandbox) && typeof sandbox === "object" && sandbox !== null && "placementNodeId" in sandbox && typeof sandbox.placementNodeId === "string" && sandbox.placementNodeId.length > 0;
-}
-function assertCodexAppServerCommandHasNoInlineArgs(params) {
-	const inlineArgs = detectWindowsSpawnCommandInlineArgs(params.command);
-	if (!inlineArgs) return;
-	const sourceLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_BIN" : "plugins.entries.codex.config.appServer.command";
-	const argsLabel = params.source === "env" ? "OPENCLAW_CODEX_APP_SERVER_ARGS" : "plugins.entries.codex.config.appServer.args";
-	throw new Error(`${sourceLabel} must be only the Codex app-server executable path; "${inlineArgs.executable}" was configured with inline arguments "${inlineArgs.arguments}". Move those arguments to ${argsLabel}, or remove the override to use the managed Codex startup path.`);
-}
-function resolveCodexPluginsPolicy(pluginConfig) {
-	const config = readCodexPluginConfig(pluginConfig).codexPlugins;
-	const configured = config !== void 0;
-	const enabled = config?.enabled === true;
-	const destructivePolicy = resolveCodexPluginDestructivePolicy(config?.allow_destructive_actions ?? true);
-	const pluginPolicies = Object.entries(config?.plugins ?? {}).flatMap(([configKey, entry]) => {
-		if (!isCodexPluginMarketplaceName(entry.marketplaceName) || !entry.pluginName) return [];
-		const entryDestructivePolicy = resolveCodexPluginDestructivePolicy(entry.allow_destructive_actions ?? config?.allow_destructive_actions ?? true);
-		return [{
-			configKey,
-			marketplaceName: entry.marketplaceName,
-			pluginName: entry.pluginName,
-			enabled: enabled && entry.enabled !== false,
-			allowDestructiveActions: entryDestructivePolicy.allowDestructiveActions,
-			destructiveApprovalMode: entryDestructivePolicy.destructiveApprovalMode
-		}];
-	}).toSorted((left, right) => left.configKey.localeCompare(right.configKey));
-	return {
-		configured,
-		enabled,
-		allowAllPlugins: enabled && config?.allow_all_plugins === true,
-		allowDestructiveActions: destructivePolicy.allowDestructiveActions,
-		destructiveApprovalMode: destructivePolicy.destructiveApprovalMode,
-		pluginPolicies
-	};
-}
-function isCodexPluginMarketplaceName(value) {
-	return typeof value === "string" && CODEX_PLUGIN_MARKETPLACE_NAME_PATTERN.test(value);
-}
-function resolveCodexPluginDestructivePolicy(policy) {
-	if (policy === "auto" || policy === "ask") return {
-		allowDestructiveActions: true,
-		destructiveApprovalMode: policy
-	};
-	return {
-		allowDestructiveActions: policy,
-		destructiveApprovalMode: policy ? "allow" : "deny"
-	};
-}
-//#endregion
-//#region extensions/codex/src/app-server/config-layer-policy.ts
-const CODEX_SESSION_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
-	"packagedDefaults",
-	"mdm",
-	"system",
-	"enterpriseManaged",
-	"user",
-	"project",
-	"sessionFlags"
-]);
-/** Read one effective snapshot for the current boundary's reviewer and tool-policy checks. */
-async function readCodexEffectiveConfig(client, cwd, signal) {
-	const response = await client.request("config/read", {
-		cwd: path.resolve(cwd),
-		includeLayers: true
-	}, { signal });
-	if (!isJsonObject(response) || !isJsonObject(response.config)) throw new Error("Codex config/read returned an invalid effective config");
-	return response;
-}
 //#endregion
 //#region extensions/codex/src/app-server/config-requirements.ts
 const UNIX_CODEX_REQUIREMENTS_PATH = "/etc/codex/requirements.toml";
@@ -659,7 +245,27 @@ function selectUserApprovalsReviewer(allowedApprovalsReviewers, execModeRequirin
 	throw new Error(`tools.exec.mode=${execModeRequiringUserReviewer ?? "ask"} requires Codex app-server user approvals`);
 }
 //#endregion
-//#region extensions/codex/src/app-server/config-reviewer.ts
+//#region extensions/codex/src/app-server/config-layer-policy.ts
+const CODEX_SESSION_OVERRIDABLE_LAYER_TYPES = /* @__PURE__ */ new Set([
+	"packagedDefaults",
+	"mdm",
+	"system",
+	"enterpriseManaged",
+	"user",
+	"project",
+	"sessionFlags"
+]);
+/** Read one effective snapshot for the current boundary's reviewer and tool-policy checks. */
+async function readCodexEffectiveConfig(client, cwd, signal) {
+	const response = await client.request("config/read", {
+		cwd: path.resolve(cwd),
+		includeLayers: true
+	}, { signal });
+	if (!isJsonObject(response) || !isJsonObject(response.config)) throw new Error("Codex config/read returned an invalid effective config");
+	return response;
+}
+//#endregion
+//#region extensions/codex/src/app-server/config-reviewer-policy.ts
 const CODEX_CONFIG_TOML_FILENAME = "config.toml";
 /** Cloud/system config can redirect reviews after local home/profile checks have passed. */
 async function assertCodexModelBackedReviewerEffectiveConfig(params) {
@@ -677,17 +283,17 @@ async function assertCodexModelBackedReviewerEffectiveConfig(params) {
 function isTrustedOptionalReviewerEndpoint(value, isTrusted) {
 	return value == null || typeof value === "string" && isTrusted(value);
 }
-function canUseCodexModelBackedApprovalsReviewerForModel(params) {
+function canUseCodexModelBackedApprovalsReviewerForModel(params, resolveAuthProviderId) {
 	const explicitProvider = params.modelProvider?.trim().toLowerCase();
 	const inferredProvider = inferProviderFromModelRef(params.model);
 	if (explicitProvider && explicitProvider !== "codex" && explicitProvider !== "openai") return false;
-	return (inferredProvider ?? explicitProvider) === "openai" && isTrustedCodexModelBackedOpenAIProvider(params);
+	return (inferredProvider ?? explicitProvider) === "openai" && isTrustedCodexModelBackedOpenAIProvider(params, resolveAuthProviderId);
 }
-function isTrustedCodexModelBackedOpenAIProvider(params) {
+function isTrustedCodexModelBackedOpenAIProvider(params, resolveAuthProviderId) {
 	if (!openAIBaseUrlEnvOverridesAreTrustedForModelBackedReview(params.env)) return false;
 	const codexBaseUrlOverrides = readCodexBaseUrlOverridesForModelBackedReview(params);
 	if (codexBaseUrlOverrides === false || !codexBaseUrlOverrides.openAI.every(isNativeOpenAIBaseUrl) || !codexBaseUrlOverrides.chatGPT.every(isNativeChatGPTBaseUrl)) return false;
-	const openAIProviders = readConfiguredOpenAIProvidersForModelBackedReview(params.config);
+	const openAIProviders = readConfiguredOpenAIProvidersForModelBackedReview(params.config, resolveAuthProviderId);
 	if (openAIProviders.length === 0) return true;
 	return openAIProviders.every((openAIProvider) => configuredOpenAIProviderIsTrustedForModelBackedReview(openAIProvider, params.model));
 }
@@ -803,12 +409,12 @@ function resolveCodexAppServerConfigPath(params) {
 function readErrorCode(error) {
 	return error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
 }
-function readConfiguredOpenAIProvidersForModelBackedReview(config) {
+function readConfiguredOpenAIProvidersForModelBackedReview(config, resolveAuthProviderId) {
 	const providerRecords = readRecord(readRecord(readRecord(config)?.models)?.providers);
 	if (!providerRecords) return [];
 	const openAIProviders = [];
 	for (const [providerId, providerConfig] of Object.entries(providerRecords)) {
-		if (resolveProviderIdForAuth(providerId, { config }) !== "openai") continue;
+		if (resolveAuthProviderId(providerId, { config }) !== "openai") continue;
 		const record = readRecord(providerConfig);
 		if (record) openAIProviders.push(record);
 	}
@@ -1046,7 +652,7 @@ function resolveDefaultCodexAppServerPolicy(params) {
 	};
 }
 //#endregion
-//#region extensions/codex/src/app-server/config-runtime.ts
+//#region extensions/codex/src/app-server/config-options.ts
 /**
 * Sole owner of the app-server home-scope decision. Ordinary harness connections
 * default to the isolated agent home; the supervision connection owns the operator's
@@ -1059,148 +665,173 @@ function resolveCodexAppServerHomeScope(params) {
 	if (configured) return configured;
 	return params.connectionScope === "supervision" && resolveTransport(params.appServer?.transport) !== "websocket" ? "user" : "agent";
 }
-function resolveCodexAppServerRuntimeOptions(params = {}) {
-	const env = params.env ?? process.env;
-	const pluginConfig = readCodexPluginConfig(params.pluginConfig);
-	const config = pluginConfig.appServer ?? {};
-	const transport = resolveTransport(config.transport);
-	const homeScope = resolveCodexAppServerHomeScope({ appServer: config });
-	if (transport !== "stdio" && pluginConfig.sessionCatalog?.homes?.length) throw new Error("plugins.entries.codex.config.sessionCatalog.homes requires appServer.transport=stdio");
-	const configCommand = readNonEmptyString(config.command);
-	const envCommand = readNonEmptyString(env.OPENCLAW_CODEX_APP_SERVER_BIN);
-	const command = configCommand ?? envCommand ?? "codex";
-	const commandSource = configCommand ? "config" : envCommand ? "env" : "managed";
-	if (commandSource === "config" || commandSource === "env") assertCodexAppServerCommandHasNoInlineArgs({
-		command,
-		source: commandSource
-	});
-	const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
-	const headers = normalizeHeaders(config.headers);
-	const clearEnv = normalizeTrimmedStringList(config.clearEnv);
-	const authToken = normalizeCodexAppServerSecretInput({
-		value: config.authToken,
-		path: "plugins.entries.codex.config.appServer.authToken"
-	});
-	const url = readNonEmptyString(config.url) ?? (transport === "unix" ? "unix://" : void 0);
-	const connectionClass = inferCodexAppServerConnectionClass({
-		transport,
-		url
-	});
-	const remoteAppsSubstrate = "preconfigured";
-	const remoteWorkspaceRoot = normalizeRemoteWorkspaceRoot(config.remoteWorkspaceRoot);
-	const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
-		execMode: params.execMode,
-		execPolicy: params.execPolicy
-	});
-	if (!params.sessionPermissionMode) assertCodexAppServerAllowedForOpenClawExecMode(execMode);
-	const explicitPolicyMode = resolvePolicyMode(config.mode) ?? resolvePolicyMode(env.OPENCLAW_CODEX_APP_SERVER_MODE);
-	const configuredSandbox = resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX);
-	const explicitApprovalsReviewer = resolveApprovalsReviewer(config.approvalsReviewer);
-	const normalizedPolicyMode = resolveCodexPolicyModeForOpenClawExecMode(execMode);
-	const ignoreLegacyYoloPolicyMode = normalizedPolicyMode === "guardian" && explicitPolicyMode === "yolo";
-	const canUseModelBackedReviewer = canUseCodexModelBackedApprovalsReviewerForModel({
-		modelProvider: params.modelProvider,
-		model: params.model,
-		config: params.config,
-		env,
-		agentDir: params.agentDir,
-		codexConfigToml: params.codexConfigToml,
-		homeScope
-	});
-	const forceUserReviewer = !canUseModelBackedReviewer && (explicitApprovalsReviewer === "auto_review" || explicitApprovalsReviewer === "guardian_subagent" || explicitPolicyMode === "guardian" && explicitApprovalsReviewer !== "user") || execMode !== void 0 && execMode !== "full" && (execMode !== "auto" || !canUseModelBackedReviewer);
-	const forceGuardianReviewer = execMode === "auto" && canUseModelBackedReviewer;
-	const execModeRequiringPromptingApprovals = execMode === "auto" || execMode === "ask" ? execMode : forceUserReviewer ? "ask" : void 0;
-	const forceDangerFullAccessSandbox = params.execPolicy?.touched === true && params.execPolicy.security === "full" && params.execPolicy.ask === "always";
-	const forcePerCommandApprovals = params.execPolicy?.ask === "always";
-	const requirementsToml = forcePerCommandApprovals ? readCodexRequirementsToml({
-		env,
-		requirementsToml: params.requirementsToml,
-		requirementsPath: params.requirementsPath,
-		readRequirementsFile: params.readRequirementsFile,
-		platform: params.platform
-	}) ?? null : params.requirementsToml;
-	if (forcePerCommandApprovals && requirementsToml && parseAllowedApprovalPoliciesFromCodexRequirements(requirementsToml)?.has("untrusted") === false) throw new Error("tools.exec.ask=always requires Codex app-server per-command approvals");
-	const forceRuntimePolicy = forceUserReviewer || forceGuardianReviewer || forceDangerFullAccessSandbox;
-	const defaultPolicy = explicitPolicyMode && !forceRuntimePolicy && !ignoreLegacyYoloPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
-		transport,
-		env,
-		forceGuardian: normalizedPolicyMode === "guardian",
-		forceUserReviewer: forceUserReviewer || !canUseModelBackedReviewer,
-		execModeRequiringPromptingApprovals,
-		requirementsToml,
-		requirementsPath: params.requirementsPath,
-		readRequirementsFile: params.readRequirementsFile,
-		platform: params.platform,
-		hostName: params.hostName,
-		execModeRequiringUserReviewer: forceUserReviewer ? execMode : void 0
-	});
-	const preserveExplicitAutoSandbox = forceGuardianReviewer && configuredSandbox === "read-only";
-	const forcedPolicy = forceRuntimePolicy ? {
-		approvalPolicy: forcePerCommandApprovals ? "untrusted" : defaultPolicy?.approvalPolicy ?? "on-request",
-		sandbox: preserveExplicitAutoSandbox ? void 0 : forceDangerFullAccessSandbox ? selectForcedDangerFullAccessSandbox({
-			configuredSandbox,
-			defaultPolicy,
-			openClawSandboxActive: Boolean(params.openClawSandboxActive)
-		}) : selectForcedPromptingSandbox({
-			configuredSandbox,
-			defaultSandbox: defaultPolicy?.sandbox
-		}),
-		approvalsReviewer: defaultPolicy?.approvalsReviewer ?? (forceUserReviewer ? "user" : "auto_review")
-	} : void 0;
-	const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
-	const serviceTier = normalizeCodexServiceTier(config.serviceTier);
-	const resolvedSandbox = forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access");
-	if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
-	if (transport === "websocket" && homeScope === "user") throw new Error("plugins.entries.codex.config.appServer.homeScope=user requires appServer.transport=stdio or unix");
-	if (transport === "unix" && homeScope !== "user") throw new Error("plugins.entries.codex.config.appServer.transport=unix requires appServer.homeScope=user");
-	if (transport === "unix" && !url?.startsWith("unix://")) throw new Error("plugins.entries.codex.config.appServer.url must use unix:// when appServer.transport is unix");
-	assertCodexAppServerConnectionSecurity({
-		transport,
-		url,
-		authToken,
-		headers
-	});
-	const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
-	const envApprovalPolicy = resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY);
-	const approvalPolicy = configApprovalPolicy ?? envApprovalPolicy ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never");
-	const approvalPolicySource = configApprovalPolicy ? "config" : envApprovalPolicy ? "env" : defaultPolicy?.approvalPolicy ? "requirements" : "implicit";
-	const computerUseConfig = resolveCodexComputerUseConfig({
-		pluginConfig: params.pluginConfig,
-		env
-	});
-	const managedCommandOrder = params.managedCommandOrder ?? (homeScope === "user" || computerUseConfig.enabled ? "desktop-first" : "package-first");
-	const includeManagedCommandOrder = commandSource === "managed" && (managedCommandOrder === "desktop-first" || params.managedCommandOrder === "package-first");
-	const managedComputerUsePluginNames = [.../* @__PURE__ */ new Set([DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, computerUseConfig.pluginName])];
-	return {
-		start: {
-			transport,
-			homeScope,
+function createCodexAppServerConfig({ resolveProviderIdForAuth }) {
+	function resolveCodexAppServerRuntimeOptions(params = {}) {
+		const env = params.env ?? process.env;
+		const pluginConfig = readCodexPluginConfig(params.pluginConfig);
+		const config = pluginConfig.appServer ?? {};
+		const transport = resolveTransport(config.transport);
+		const homeScope = resolveCodexAppServerHomeScope({ appServer: config });
+		if (transport !== "stdio" && pluginConfig.sessionCatalog?.homes?.length) throw new Error("plugins.entries.codex.config.sessionCatalog.homes requires appServer.transport=stdio");
+		const configCommand = readNonEmptyString(config.command);
+		const envCommand = readNonEmptyString(env.OPENCLAW_CODEX_APP_SERVER_BIN);
+		const command = configCommand ?? envCommand ?? "codex";
+		const commandSource = configCommand ? "config" : envCommand ? "env" : "managed";
+		if (commandSource === "config" || commandSource === "env") assertCodexAppServerCommandHasNoInlineArgs({
 			command,
-			commandSource,
-			...includeManagedCommandOrder ? { managedCommandOrder } : {},
-			...commandSource === "managed" ? { managedComputerUsePluginNames } : {},
-			args: args.length > 0 ? args : [
-				"app-server",
-				"--listen",
-				"stdio://"
-			],
-			...url ? { url } : {},
-			...authToken ? { authToken } : {},
-			headers,
-			...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
-		},
-		connectionClass,
-		remoteAppsSubstrate,
-		...remoteWorkspaceRoot ? { remoteWorkspaceRoot } : {},
-		codeModeOnly: config.codeModeOnly === true,
-		loopDetectionPreToolUseRelay: config.loopDetectionPreToolUseRelay !== false,
-		requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
-		approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
-		approvalPolicySource,
-		sandbox: resolvedSandbox,
-		approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
-		...serviceTier ? { serviceTier } : {},
-		...resolveCodexAppServerNetworkProxy(config.networkProxy, resolvedSandbox)
+			source: commandSource
+		});
+		const args = resolveArgs(config.args, env.OPENCLAW_CODEX_APP_SERVER_ARGS);
+		const headers = normalizeHeaders(config.headers);
+		const clearEnv = normalizeTrimmedStringList(config.clearEnv);
+		const authToken = normalizeCodexAppServerSecretInput({
+			value: config.authToken,
+			path: "plugins.entries.codex.config.appServer.authToken"
+		});
+		const url = readNonEmptyString(config.url) ?? (transport === "unix" ? "unix://" : void 0);
+		const connectionClass = inferCodexAppServerConnectionClass({
+			transport,
+			url
+		});
+		const remoteAppsSubstrate = "preconfigured";
+		const remoteWorkspaceRoot = normalizeRemoteWorkspaceRoot(config.remoteWorkspaceRoot);
+		const execMode = resolveEffectiveOpenClawExecModeForCodexAppServer({
+			execMode: params.execMode,
+			execPolicy: params.execPolicy
+		});
+		if (!params.sessionPermissionMode) assertCodexAppServerAllowedForOpenClawExecMode(execMode);
+		const explicitPolicyMode = resolvePolicyMode(config.mode) ?? resolvePolicyMode(env.OPENCLAW_CODEX_APP_SERVER_MODE);
+		const configuredSandbox = resolveSandbox(config.sandbox) ?? resolveSandbox(env.OPENCLAW_CODEX_APP_SERVER_SANDBOX);
+		const explicitApprovalsReviewer = resolveApprovalsReviewer(config.approvalsReviewer);
+		const normalizedPolicyMode = resolveCodexPolicyModeForOpenClawExecMode(execMode);
+		const ignoreLegacyYoloPolicyMode = normalizedPolicyMode === "guardian" && explicitPolicyMode === "yolo";
+		const canUseModelBackedReviewer = canUseCodexModelBackedApprovalsReviewerForModel({
+			modelProvider: params.modelProvider,
+			model: params.model,
+			config: params.config,
+			env,
+			agentDir: params.agentDir,
+			codexConfigToml: params.codexConfigToml,
+			homeScope
+		}, resolveProviderIdForAuth);
+		const forceUserReviewer = !canUseModelBackedReviewer && (explicitApprovalsReviewer === "auto_review" || explicitApprovalsReviewer === "guardian_subagent" || explicitPolicyMode === "guardian" && explicitApprovalsReviewer !== "user") || execMode !== void 0 && execMode !== "full" && (execMode !== "auto" || !canUseModelBackedReviewer);
+		const forceGuardianReviewer = execMode === "auto" && canUseModelBackedReviewer;
+		const execModeRequiringPromptingApprovals = execMode === "auto" || execMode === "ask" ? execMode : forceUserReviewer ? "ask" : void 0;
+		const forceDangerFullAccessSandbox = params.execPolicy?.touched === true && params.execPolicy.security === "full" && params.execPolicy.ask === "always";
+		const forcePerCommandApprovals = params.execPolicy?.ask === "always";
+		const requirementsToml = forcePerCommandApprovals ? readCodexRequirementsToml({
+			env,
+			requirementsToml: params.requirementsToml,
+			requirementsPath: params.requirementsPath,
+			readRequirementsFile: params.readRequirementsFile,
+			platform: params.platform
+		}) ?? null : params.requirementsToml;
+		if (forcePerCommandApprovals && requirementsToml && parseAllowedApprovalPoliciesFromCodexRequirements(requirementsToml)?.has("untrusted") === false) throw new Error("tools.exec.ask=always requires Codex app-server per-command approvals");
+		const forceRuntimePolicy = forceUserReviewer || forceGuardianReviewer || forceDangerFullAccessSandbox;
+		const defaultPolicy = explicitPolicyMode && !forceRuntimePolicy && !ignoreLegacyYoloPolicyMode ? void 0 : resolveDefaultCodexAppServerPolicy({
+			transport,
+			env,
+			forceGuardian: normalizedPolicyMode === "guardian",
+			forceUserReviewer: forceUserReviewer || !canUseModelBackedReviewer,
+			execModeRequiringPromptingApprovals,
+			requirementsToml,
+			requirementsPath: params.requirementsPath,
+			readRequirementsFile: params.readRequirementsFile,
+			platform: params.platform,
+			hostName: params.hostName,
+			execModeRequiringUserReviewer: forceUserReviewer ? execMode : void 0
+		});
+		const preserveExplicitAutoSandbox = forceGuardianReviewer && configuredSandbox === "read-only";
+		const forcedPolicy = forceRuntimePolicy ? {
+			approvalPolicy: forcePerCommandApprovals ? "untrusted" : defaultPolicy?.approvalPolicy ?? "on-request",
+			sandbox: preserveExplicitAutoSandbox ? void 0 : forceDangerFullAccessSandbox ? selectForcedDangerFullAccessSandbox({
+				configuredSandbox,
+				defaultPolicy,
+				openClawSandboxActive: Boolean(params.openClawSandboxActive)
+			}) : selectForcedPromptingSandbox({
+				configuredSandbox,
+				defaultSandbox: defaultPolicy?.sandbox
+			}),
+			approvalsReviewer: defaultPolicy?.approvalsReviewer ?? (forceUserReviewer ? "user" : "auto_review")
+		} : void 0;
+		const policyMode = ignoreLegacyYoloPolicyMode ? normalizedPolicyMode : explicitPolicyMode ?? normalizedPolicyMode ?? defaultPolicy?.mode ?? "yolo";
+		const serviceTier = normalizeCodexServiceTier(config.serviceTier);
+		const resolvedSandbox = forcedPolicy?.sandbox ?? configuredSandbox ?? defaultPolicy?.sandbox ?? (policyMode === "guardian" ? "workspace-write" : "danger-full-access");
+		if (transport === "websocket" && !url) throw new Error("plugins.entries.codex.config.appServer.url is required when appServer.transport is websocket");
+		if (transport === "websocket" && homeScope === "user") throw new Error("plugins.entries.codex.config.appServer.homeScope=user requires appServer.transport=stdio or unix");
+		if (transport === "unix" && homeScope !== "user") throw new Error("plugins.entries.codex.config.appServer.transport=unix requires appServer.homeScope=user");
+		if (transport === "unix" && !url?.startsWith("unix://")) throw new Error("plugins.entries.codex.config.appServer.url must use unix:// when appServer.transport is unix");
+		assertCodexAppServerConnectionSecurity({
+			transport,
+			url,
+			authToken,
+			headers
+		});
+		const configApprovalPolicy = resolveApprovalPolicy(config.approvalPolicy);
+		const envApprovalPolicy = resolveApprovalPolicy(env.OPENCLAW_CODEX_APP_SERVER_APPROVAL_POLICY);
+		const approvalPolicy = configApprovalPolicy ?? envApprovalPolicy ?? defaultPolicy?.approvalPolicy ?? (policyMode === "guardian" ? "on-request" : "never");
+		const approvalPolicySource = configApprovalPolicy ? "config" : envApprovalPolicy ? "env" : defaultPolicy?.approvalPolicy ? "requirements" : "implicit";
+		const computerUseConfig = resolveCodexComputerUseConfig({
+			pluginConfig: params.pluginConfig,
+			env
+		});
+		const managedCommandOrder = params.managedCommandOrder ?? (homeScope === "user" || computerUseConfig.enabled ? "desktop-first" : "package-first");
+		const includeManagedCommandOrder = commandSource === "managed" && (managedCommandOrder === "desktop-first" || params.managedCommandOrder === "package-first");
+		const managedComputerUsePluginNames = [.../* @__PURE__ */ new Set([DEFAULT_CODEX_COMPUTER_USE_PLUGIN_NAME, computerUseConfig.pluginName])];
+		return {
+			start: {
+				transport,
+				homeScope,
+				command,
+				commandSource,
+				...includeManagedCommandOrder ? { managedCommandOrder } : {},
+				...commandSource === "managed" ? { managedComputerUsePluginNames } : {},
+				args: args.length > 0 ? args : [
+					"app-server",
+					"--listen",
+					"stdio://"
+				],
+				...url ? { url } : {},
+				...authToken ? { authToken } : {},
+				headers,
+				...transport === "stdio" && clearEnv.length > 0 ? { clearEnv } : {}
+			},
+			connectionClass,
+			remoteAppsSubstrate,
+			...remoteWorkspaceRoot ? { remoteWorkspaceRoot } : {},
+			codeModeOnly: config.codeModeOnly === true,
+			loopDetectionPreToolUseRelay: config.loopDetectionPreToolUseRelay !== false,
+			requestTimeoutMs: normalizePositiveNumber(config.requestTimeoutMs, 6e4),
+			approvalPolicy: forcedPolicy?.approvalPolicy ?? approvalPolicy,
+			approvalPolicySource,
+			sandbox: resolvedSandbox,
+			approvalsReviewer: forcedPolicy?.approvalsReviewer ?? explicitApprovalsReviewer ?? defaultPolicy?.approvalsReviewer ?? (policyMode === "guardian" ? "auto_review" : "user"),
+			...serviceTier ? { serviceTier } : {},
+			...resolveCodexAppServerNetworkProxy(config.networkProxy, resolvedSandbox)
+		};
+	}
+	/** Resolves the passive supervision control connection without changing harness defaults. */
+	function resolveCodexSupervisionAppServerRuntimeOptions(params = {}) {
+		const pluginConfig = readCodexPluginConfig(params.pluginConfig);
+		const appServer = pluginConfig.appServer ?? {};
+		const homeScope = resolveCodexAppServerHomeScope({
+			appServer,
+			connectionScope: "supervision"
+		});
+		return resolveCodexAppServerRuntimeOptions({
+			...params,
+			pluginConfig: {
+				...pluginConfig,
+				appServer: {
+					...appServer,
+					homeScope
+				}
+			}
+		});
+	}
+	return {
+		resolveCodexAppServerRuntimeOptions,
+		resolveCodexSupervisionAppServerRuntimeOptions
 	};
 }
 /**
@@ -1320,24 +951,5 @@ function codexSandboxPolicyForTurn(mode, cwd, nativeArgs = []) {
 		excludeSlashTmp
 	};
 }
-/** Resolves the passive supervision control connection without changing harness defaults. */
-function resolveCodexSupervisionAppServerRuntimeOptions(params = {}) {
-	const pluginConfig = readCodexPluginConfig(params.pluginConfig);
-	const appServer = pluginConfig.appServer ?? {};
-	const homeScope = resolveCodexAppServerHomeScope({
-		appServer,
-		connectionScope: "supervision"
-	});
-	return resolveCodexAppServerRuntimeOptions({
-		...params,
-		pluginConfig: {
-			...pluginConfig,
-			appServer: {
-				...appServer,
-				homeScope
-			}
-		}
-	});
-}
 //#endregion
-export { resolveOpenClawExecPolicyForCodexAppServer as A, isJsonObject as B, CODEX_SESSION_OVERRIDABLE_LAYER_TYPES as C, isCodexSandboxExecServerEnabled as D, isCodexRemoteExecPlacementSandbox as E, withEphemeralCodexAuthStore as F, CODEX_INTERACTIVE_CUSTOM_THREAD_SOURCES as I, CODEX_INTERACTIVE_THREAD_SOURCE_KINDS as L, resolveCodexAppServerHomeDir as M, resolveCodexAppServerLocalHomeDir as N, readCodexPluginConfig as O, resolveCodexAppServerUserHomeDir as P, CODEX_OPENCLAW_DIRECT_DYNAMIC_TOOL_NAMESPACE as R, selectUserApprovalsReviewer as S, isCodexPairedNodeRemoteExecPlacementSandbox as T, isRpcResponse as V, parseAllowedApprovalsReviewersFromCodexRequirements as _, resolveCodexAppServerStartOptionsForAgent as a, selectGuardianApprovalPolicy as b, assertCodexAppServerConnectionSecurity as c, shouldAutoApproveCodexAppServerApprovals as d, withMcpElicitationsApprovalPolicy as f, parseAllowedApprovalPoliciesFromCodexRequirements as g, resolveCodexModelBackedReviewerPolicyContext as h, resolveCodexAppServerRuntimeOptions as i, selectGuardianSandbox as j, resolveCodexPluginsPolicy as k, hasCodexMcpToolApprovalOverrides as l, canUseCodexModelBackedApprovalsReviewerForModel as m, codexSandboxPolicyForTurn as n, resolveCodexComputerUseConfig as o, assertCodexModelBackedReviewerEffectiveConfig as p, resolveCodexAppServerHomeScope as r, resolveCodexSupervisionAppServerRuntimeOptions as s, codexAppServerStartOptionsKey as t, resolveCodexAppServerNetworkProxy as u, parseAllowedSandboxModesFromCodexRequirements as v, readCodexEffectiveConfig as w, selectGuardianApprovalsReviewer as x, readCodexRequirementsToml as y, flattenCodexDynamicToolFunctions as z };
+export { selectUserApprovalsReviewer as C, selectGuardianApprovalsReviewer as S, parseAllowedApprovalPoliciesFromCodexRequirements as _, resolveCodexAppServerStartOptionsForAgent as a, readCodexRequirementsToml as b, hasCodexMcpToolApprovalOverrides as c, withMcpElicitationsApprovalPolicy as d, assertCodexModelBackedReviewerEffectiveConfig as f, readCodexEffectiveConfig as g, CODEX_SESSION_OVERRIDABLE_LAYER_TYPES as h, resolveCodexAppServerHomeScope as i, resolveCodexAppServerNetworkProxy as l, resolveCodexModelBackedReviewerPolicyContext as m, codexSandboxPolicyForTurn as n, resolveCodexComputerUseConfig as o, canUseCodexModelBackedApprovalsReviewerForModel as p, createCodexAppServerConfig as r, assertCodexAppServerConnectionSecurity as s, codexAppServerStartOptionsKey as t, shouldAutoApproveCodexAppServerApprovals as u, parseAllowedApprovalsReviewersFromCodexRequirements as v, selectGuardianSandbox as w, selectGuardianApprovalPolicy as x, parseAllowedSandboxModesFromCodexRequirements as y };